Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 05:18
Static task
static1
Behavioral task
behavioral1
Sample
3c1dee6d9e96ef03c8a993ef7a386c8a_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3c1dee6d9e96ef03c8a993ef7a386c8a_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3c1dee6d9e96ef03c8a993ef7a386c8a_JaffaCakes118.html
-
Size
6KB
-
MD5
3c1dee6d9e96ef03c8a993ef7a386c8a
-
SHA1
f6f4d727b897640fd89b02206a6ac731bb4d86ae
-
SHA256
3ce6df52a5c1873882f188bc53cc57a37338842b135cc5beae27f4c164f37edf
-
SHA512
0ea6febb5d70a902174da3dd07a8b3027c480ec586a922242eb972a69359ae6eba809f18afb8d83d33ce995215c274b2d65dc49c52ca34a6e9f0d5d277d35dd0
-
SSDEEP
96:uzVs+ux7kfLLY1k9o84d12ef7CSTUaYcEZ7ru7f:csz7kfAYS/ob76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A3E4D01-400E-11EF-B0F5-6E739D7B0BBB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000004c1c384db412fbeda874bdc5b563599c7707506ecb797da9c52fb48b338a4bf8000000000e80000000020000200000007670fb96b30d29c2e3159ffc06618aa8294f71be4b0fc76ee035e76bbff131ea90000000fddce132436bba5fe748573f91a52fdc647907767b13ef8988387e755998db4b54367e3c96c5a90ec633177ddfb2b706eb513abd3f956fc833311969f76972ad23a711b51ea0ab5b2409388bad0d0d7d55e8a7a4611d2fb3ad44107d69ed9aeeb6c3e656cf18efe6b1ac654a3b726b222cf4a32a2e55e6dd0f257fc6fc8364822785b73f5f8804b6aae93821f2694210400000005ba2b8a6458d55b41a1c2c5d9af437b2b2bfbc1fa4da353e6a617820d19345f47da44287a75b2cef8ad00f89101c32563802132f49a973fb9e813acde6b8850b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426923400" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000246419a9def0e4bb79d709e524ecddf55897425073c28ecd033aad906bde9671000000000e800000000200002000000085094c47132a343358543b8d5a8590f815d3c652c41448fd6d4c46a0eed6e08920000000746fe0e6b8bdd69bf8515af4c248f0c690aab835fb988c9e0b922a9afd505f3c4000000021c5c4b76627746d98af1b6cb2ea680f046754b8d38566c53621f8f43f147529b1baa46f1a24c26a957525484fe318a68a33d095c0424fc700b90bf0f961bf36 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0af27111bd4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1848 2468 iexplore.exe 31 PID 2468 wrote to memory of 1848 2468 iexplore.exe 31 PID 2468 wrote to memory of 1848 2468 iexplore.exe 31 PID 2468 wrote to memory of 1848 2468 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c1dee6d9e96ef03c8a993ef7a386c8a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e07323a9a9a549a847dc251aa39c17d5
SHA136f23f46ffd8c2133dea6bbb7a084263b13eb7c6
SHA256f86df9689f06935503a1f0fff548eae3956a282dec0cfddc112835330629dfec
SHA512530267bae34e016d51bbbc6a762f8368dad4ac5e1650cf232f9942131105ba88668a311f5a7e4ea590b4f1d46292ae9c9c8731fbb30d050e60dd40014f77149a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56a325f4c7e83de84403950391937f32a
SHA1ad50b21ba93ce8558b9d07dab168ceffc4dbd381
SHA256c358adab56552b0fe32cbc93c4b5356bcd17487e91d94aa083774fb8b66b4221
SHA512edbd4c6b9fd2312462cd54c08966631509be3b61a186590b6c83b4a4f366054122aa57a12f6530ddc7dc6f18abc12aac6ddc6acf7bdc89a26dba0f86c92a7a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58d954b85ef5daa6d687b410e6a78aebb
SHA10ae10e178b2b96936e3a889010aeace6f5338812
SHA256735e6e06d90050fe197e4aed719d97297f0ed9023a1bdca0677706fe7f124ad1
SHA5126424d42cab5e9daf1ab11916d65d1307a2ea524124a3194373b79f0d74aa4868e9a25214488ab2c0f5f2958cb2b51479ba7bbd2d792e69405bba87c3602063c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD572168abad2742cab92cf987d166459c6
SHA13a393b9f0aebf09a176c7757a3ee6b0cd31efca2
SHA256eeb4703da2db7db2b0086ab8a0ee53e200674c1e8ec64279a373d6d3d8db7932
SHA51230b47e43c44a8ddc6e7c2d42a15395d40dbdb4cbcf2554ce04f918e3f1d04363888a2ce12b41c500be72727a3883060e41eb53ea810148e1720b5fb3338d908f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fadc211051ac8d719ab8588f9fcc2fb9
SHA132a5c407237197f0b578050888b0eeb6af4c0270
SHA2567c8d24808b49dcec58e4529ca69a03d8b918fb1f1cd75929cbada0216d92e167
SHA5126304bc2a8f20a748b37615b123c5a843c327662c24ce102c1c752db25da041f52eba75abf711c283bbc7f4792485126e647e0d1412f117978da03fd0c13dee88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50c34b985b3e8d279989b707af7d85cfa
SHA1417b1cfee7eab51ac7c6c866c74d161ba600f752
SHA2561832e5cf28a5ca2b01d80c66c4afc2a3a0a08149b202a096d58787248cf498b0
SHA512e1b0b254d54a7c961d8fc247b7954a55473aa753a75cec3ea4ea5ec6c9c53bc2a4a13c589342198101e0c41694ec6db15fb094f974c460a9702344f69fb3f3f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e65342c154d2295ead87d76935a5aab5
SHA11bdcc65c9adb90d2f60a7a2f2f4f5b16432c9091
SHA256ccf2096596c0d2584540eb87d5861200f49a3d8533a82de38e26e7d6b05c4294
SHA512269cce6d82bcabbf8019278f2bdadfaee98e893156ca1a2e106b8479eeb53228975fec4142c2a9cc6d57d19819ece87a77c5fbef279c601743ca17683b241587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5897b4e6d9eb91ffcaf60416cb62ab321
SHA110d13ba2e7962eab08054711790df84a14d8b788
SHA2569df30658535059d289678579c41771c074282069d8e3a752f572143abced8369
SHA5129e045b5605cf6054049aea9d9cd3dbd4d7a31960921abd56a4953e538b3cd700982d9adbb6f73d3a7bf43191ec745a9db772cfcdd05175a9f14ded2812c9b4ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ed29bdfaf8fac311439f8dd2f1dbfe26
SHA14410c9c4b29da394647fba96e4eac09690cb97ec
SHA25679ffa77c1115c893215877e9682afc99ee08da6292fd0945a1f6d6574e33bd3b
SHA512465b2e43e5e3b9d95158520cbb6c9807d788ca855705c3c8dcfb4a89b4cef9f9ed8960e59ec6ea6392860ddfa59292c5e3dc2f59bf312e520e2ff9c6e4f764fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54c3f0ebe39d2be5f0c1332fdd2f7e642
SHA1531b49bddcbfec11ddd18cd70b29470bf69ababa
SHA25610ca7f0ffc85959efca1031b610ce7b12488c307c8ead21ff9f3558c77962891
SHA5122a069de00a6414d7c0131a75f4f562a856af29d9e8fb3375de4fdb086b24231b9ccc9e24f66dbf617316c6274b3ce9d5fb7c8bd56019ea4f5e2f83a1eeb8f267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD599938ac3ee9608ca2bf7d268ae260dfe
SHA1d6788ec46f921e4345190ca3ce8fd4798efa862b
SHA256f359aaece458fe6b24dc7df104bd62131ec2e29903656c6b0028abd18bfabfb0
SHA5128462ba567982bc6f04b3bf58943a1b817442bc5bfb00e0010b0a79078dcf3cdeb3839e771b8c63eafa1b27e8748aadfcd89709110653a2a9905bb80b1ec66ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD582416cd2f168faaa0d67d76bc1af7250
SHA130bed6015601690e4b0a1671c0de12cf3cbfc35c
SHA25642ec1f48ed4c366173febbcba4cd0ee854b788522ab566b2f8378c4415edf61b
SHA5128efce9fc85cffda1b745c6fefeb9bb0d05dbfd455f0ee747566396f035a2831cbbcb62fe0b30632bbe56cd52a6cd4ec4780feadd7c2abe2970596ff7e30b1390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59c01ff51358c7a3ccfff7a3374b930c6
SHA15c20eb105654ce90a8746bc2f1e2ffa70b93023e
SHA256d1fd542b4856dcb822c7b4d4f8222466ad60377e064f34f6f4e89d68270c5997
SHA5120de99fefdb2b37d8f0186027cae188b638292d9043ffdf4885cafe55af8701f38d8742abdeefcb02be1dbfc8309fbb122eb0f7ce747a8b6691053210b47eb177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e7c64243daa87031a8379fe15b331e87
SHA11f96ed11d6f7ac706a99253f40a9b40c622d2c25
SHA256fb4e75c4ec708487aa78c36b23c0c40f56b51cd82583493b2a445b280eb5bc63
SHA51242631d1dc83b75a25aa70e023fd4c4459982cceba5034d26276be29484571c9ef0e7ca27734adcbc4f0503f1206288c853f97f762ca858f9e3eb8e9451af9e7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d5034d946b14d7386d961ce2a6a5c684
SHA1c125857a3e9ff11f59d8bbad2e8cbe4c4448f09b
SHA256a245e966a94fb4991711afb353f083c69ebb451b707fc6a48744890dd4bc5416
SHA51264c75950de957b0a67870251b354135cb1554d03004c3f2dd92e6d3e7e8b4dfef2ba4cf6dd4ec440fc54907f99d5f3d9c13d7a9890689659bf708a89f33e4adc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dd0023e8537a2920b25caa16a3aee10d
SHA14d7c00dcc13794ab5fca83566ae9238c296a3823
SHA25679ed4db7c8bb829484a927ade8b0ba2cc15c72d72a47f8dfe9705f21b741ba31
SHA512a26656f9336bba7dac90497d05e79bcaa89cdce151449779a6b0c5813853855fcb88904e1187e7c2328ed759244d638ba576dd9b70285452b80bfa865f5e3c59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD516d81c7a5c39ac8c279ad56202ee8834
SHA132a9924136b0146349ebfb1e3f0fed154f8c34a7
SHA25647d6239eadf66d47b9d24a4a897d8e62036a594e5c1479b17faebefcffbb2c95
SHA5123b6b8a00015e45759502800792b2bdc55cc9d3d724da0365e8eaaf90b840111f8d26b6a3207d388eb99337a20dd936a3de51fe480970d88d7ead289ddc46b6eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD591e99aedbceaaea21432e03e1418bbfe
SHA16f570d2b0e5d3c912768c670deb81b7e22912ebe
SHA2568f56009a6e85065c548bdb112a4f4af5b4ff42b4a2be8dc1b2057c6ad202e7d1
SHA512552822aeffce61a8d6fe06f6a69402f8d0b70b59de29ba67cdfed29cff01908ef667cc2a4280f1c2df7ad010b5f34f2aec78a1d47f4cb9c1c27f0bc30b9e78b1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b